Privacy Policy

Effective Date: 10th October 2025

Last Updated: 21st August 2026

Introduction and Legal Framework

This Privacy Policy governs the collection, use, disclosure, and protection of personal data submitted through Strategy India’s “Report A Scam” fraud reporting system (the “System”). The System enables victims, informants, complainants, and witnesses (collectively, “Reporters” or “you”) to report suspected multi-level marketing (MLM) fraud and other deceptive business operations deploying unlawful MLM compensation plans.

This Policy is issued in strict compliance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules, notifications, and directions issued thereunder, and applies to all personal data processed in connection with fraud reports submitted to Strategy India.

CRITICAL NOTICE: This System is an intelligence-gathering and public awareness mechanism, not a law enforcement platform. Strategy India is a private consultancy, not a government agency, and does not conduct criminal investigations. Information you provide may be shared with law enforcement authorities to facilitate investigations and protect the public from fraudulent schemes which deploy the MLM compensation plans.

Data Fiduciary and Grievance Officer

Strategy India acts as the Data Fiduciary for the information submitted.

• Data Fiduciary Details: Strategy India, Unit No. 1701-1704, Level 17, Wing B & C, One BKC Centre, Plot No. C-66, G Block, Bandra Kurla Complex, Bandra East, Mumbai 400051, India. Email: [email protected]. Phone: +91-22-40238899
• Grievance Officer (DPDP Act): Name: Akshay Y. Designation: Legal Officer & Grievance Officer. Email: [email protected]. Phone: +91-22-6807 3106. Address: Unit No. 1701-1704, Level 17, Wing B & C, One BKC Centre, Plot No. C-66, G Block, Bandra Kurla Complex, Bandra East, Mumbai 400051, India
• Business Hours: Monday to Friday, 09:30 to 18:00 Indian Standard Time (IST) (excluding public holidays)

Categories of Personal Data Collected

3.1 Reporter Information
When you submit a fraud report, we may collect your identity data (full name, contact details, voluntary national identification, and relationship to the alleged fraud). We may also collect victimisation data, including financial loss records, duration of involvement, and psychological or emotional impacts. Additionally, we collect the evidence and documentation you provide, such as contracts, screenshots, bank statements, and communication records.

3.2 Third-Party Data
You may submit information regarding individuals or entities you believe are operating fraudulent schemes. This includes names of promoters and stakeholders, company trading names, business addresses, compensation plan structures, and recruitment tactics. By submitting third-party data, you legally represent and warrant that you have obtained such information lawfully and that its disclosure is necessary for fraud reporting purposes.

3.3 Technical Data
Upon access and submission, the System automatically collects your IP address, device information, submission timestamps, and email metadata.

Purposes of Processing and Legal Bases

Under the DPDP Act, Strategy India processes your personal data strictly for lawful purposes. We process reporter information and evidence to facilitate law enforcement coordination based on your voluntary consent and the legitimate use of preventing and detecting fraud. We process all data categories for fraud analysis based on legal obligations and legitimate uses related to offence detection. We process anonymised data for public awareness alerts, grounded in the public interest of fraud prevention. Finally, we process data for legal compliance and defence to establish or exercise legal claims.

Consent and Voluntary Submission

By submitting a fraud report, you provide your free, specific, informed, unconditional, and unambiguous consent for Strategy India to process your personal data. Submission is entirely voluntary; Strategy India does not charge fees for this service nor condition any other service upon your submission. You acknowledge that you understand the risks, including the fact that submission does not create attorney-client privilege and that information may be utilised in legal proceedings.

Informant and Victim Identity Protection

6.1 Confidentiality Protections
Your identity is treated as strictly confidential by default. Reporter information is stored securely and separately from fraud scheme data. Public-facing materials, such as scam alerts and case studies, are fully anonymised. Third-party fraud scheme details (e.g., promoter names) may be published to serve the public interest.

6.2 Disclosure to Law Enforcement
Information is shared with law enforcement only upon a credible indication of unlawful activity. We limit disclosure to necessary data and share it strictly with authorised recipients, such as police departments, central agencies, and regulatory authorities. Your identity may be disclosed if you provide explicit consent, if we are legally compelled by a court order, or if deemed necessary for the investigation. We request that authorities maintain your confidentiality, though we cannot control how statutory authorities utilise the data once shared.

6.3 Retaliation Prevention
Strategy India does not tolerate retaliation. If you face harassment or threats, notify our Grievance Officer immediately. We may notify law enforcement and provide guidance on legal protections under the Whistleblower Protection Act, 2014, the Bharatiya Nyaya Sanhita, 2023, and the Bharatiya Nagarik Suraksha Sanhita, 2023. Strategy India cannot provide physical security or legal representation.

Data Sharing and Disclosure

Strategy India does not sell, rent, or trade your personal data. We share data strictly with law enforcement agencies for the prosecution of fraud, with legal advisors and forensic experts bound by professional confidentiality, with IT service providers bound by Data Processing Agreements, and with courts or tribunals when legally compelled. We also publish aggregated, irreversibly anonymised data for public alerts and research.

Data Retention and Deletion

Active case files and evidence materials are/may be retained for the duration of the investigation plus five years post-closure. Closed case files are retained for seven years from closure for historical intelligence. Reporter contact information is retained for three years from the last communication. If a report becomes subject to litigation, retention is extended indefinitely until the matter is resolved. Upon meeting deletion criteria, data is securely and permanently erased from our primary databases and backups.

Data Security Measures

We deploy enhanced security safeguards, including TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest. We enforce strict role-based access controls, multi-factor authentication, and comprehensive access logging. In the event of a personal data breach posing a real risk of harm, we will contain the breach, investigate the root cause, and notify the Data Protection Board of India and affected Reporters within 72 hours, in accordance with statutory requirements.

Data Principal Rights Under the DPDP Act

You possess the right to request access to a summary of your data, the right to request the correction of inaccurate information, and the right to request the erasure of your data when its purpose has been fulfilled or consent is withdrawn (subject to legal retention exceptions). You may withdraw your consent at any time, which will halt processing for consented purposes within 48 hours but will not affect prior lawful processing. You have the right to nominate an individual to exercise your rights in the event of incapacity, and the right to grievance redressal via our internal mechanisms or the Data Protection Board of India.

Limitations and Disclaimers

Submitting a fraud report does not create an attorney-client relationship, nor does it establish legal privilege. Strategy India does not conduct criminal investigations and cannot guarantee that authorities will investigate, prosecute, or recover lost funds. You are solely responsible for ensuring that the evidence you submit is obtained lawfully and does not violate the privacy or intellectual property rights of third parties.

International Transfers

If reports involve international schemes or utilise cloud infrastructure outside India, data may be transferred across borders. We implement robust safeguards, including Data Processing Agreements, ensuring compliance with Section 16 of the DPDP Act. By submitting a report involving international entities, you acknowledge these necessary cross-border data flows.